I85PREP
⌘ K
Ruankao Network Engineer (Intermediate) study materials
Ruankao Network Engineer (Intermediate) study resources

Ruankao Network Engineer (Intermediate): Transport Layer and Application-Layer Protocols

Ruankao Network Engineer (Intermediate) · Work through your exam, one topic at a time.

All guide sections

Transport Layer and Application-Layer Protocols

Here the exam checks connection mechanics, port numbers, and the request/response behaviour of the core services. Port confusion is the most common single source of lost marks across the whole paper.

TCP and UDP

  • TCP header is 20 bytes minimum; fields include sequence number, acknowledgement number, flags, window, checksum.
  • Three-way handshake: SYN (seq = x) → SYN+ACK (seq = y, ack = x+1) → ACK (ack = y+1). Data transfer uses cumulative acknowledgements and a sliding window.
  • Four-way close: FIN, ACK, FIN, ACK; the closer waits in TIME_WAIT (typically twice the maximum segment lifetime).
  • Flow control is receiver-driven (window); congestion control is network-driven: slow start, congestion avoidance, fast retransmit, fast recovery.
  • UDP has an 8-byte header and no connection state - used by DNS queries, DHCP, TFTP, SNMP and real-time media.

Name and address services

  • DNS is hierarchical; resolvers issue recursive queries to their configured server, which performs iterative queries to root, TLD and authoritative servers. Records: A, AAAA, CNAME, MX, NS, PTR, SOA. Port 53, TCP for zone transfers and large responses.
  • DHCP uses DORA: Discover, Offer, Request, Ack. Client 68, server 67; a relay agent forwards broadcasts across subnets; leases are renewed at 50% of duration.

Application protocols and ports

  • HTTP 80, HTTPS 443 (TLS). Methods GET/POST/PUT/DELETE; status families 1xx informational, 2xx success, 3xx redirect, 4xx client error, 5xx server error.
  • FTP 21 control and 20 data in active mode; passive mode uses an ephemeral data port opened by the server.
  • SMTP 25 (submission 587), POP3 110, IMAP 143. POP3 downloads and typically deletes; IMAP keeps server-side state and folders.
  • SNMP 161 for agent polling, 162 for traps; syslog 514; NTP 123.

Worked example

A client sends SYN with seq = 1000 and receives SYN+ACK with seq = 5000, ack = 1001. The client's final ACK carries seq = 1001 and ack = 5001. If the client then sends 200 bytes of data, its next sequence number is 1201, and the server's acknowledgement returns ack = 1201.

Traps that cost marks

  • Swapping POP3 (110) and IMAP (143), or quoting SMTP as 110.
  • Stating that FTP passive mode fails behind NAT - it is active mode that typically fails.
  • Calling DNS a pure UDP protocol when zone transfers use TCP.
  • Confusing the DHCP relay function with a second DHCP server.